February 13, 2013

Strategy Page on the “who could possibly have seen this coming” problems that the new electronic warfare organization is having with staffing:

U.S. Cyber Command (USCYBERCOM) has been operational for two years now, and it is encountering some serious problems in recruiting people qualified to deal with the enemy (skilled hackers attacking American networks for whatever reason). People in the software and Internet security business have been telling Cyber Command leaders that they will have to change the way they recruit if they want to get qualified people. That means hiring hackers who lived on the dark side (criminal hacking) at one point or another. Such recruits would not pass the screening usually given to potential government employees who would be handling, and protecting, classified information and critical Internet systems. Few government officials are willing to bend the rules, mainly because no one wants to be responsible for some rogue hacker who got hired without the usual screening. It’s safer to go by the book and use that for your defense when the inadequate recruiting effort leads to a major Cyber War disaster.

Cyber Command is headquartered in Fort Meade (outside Washington, DC), most of the manpower, and capabilities, come from the Cyber War operations the military services have already established. Within Cyber Command there are some smaller organizations that coordinate Cyber War activities among the services, as well as with other branches of the government and commercial organizations that are involved in network security. At the moment Cyber Command wants to expand its core staff from 900 to 4,900 in the next five years. Twenty percent of those new people will be civilians, including a number of software specialists sufficiently skilled to quickly recognize skillful intrusions into American networks and quickly develop countermeasures. That kind of talent is not only expensive, but those who possess often have work histories that don’t pass the normal screening. These are the personnel Cyber Command is having a difficult time recruiting.

The big problems are not only recruiting hackers (technical personnel who can deal with the bad-guy hackers out there) but also managing them. The problem is one of culture, and economics. The military is a strict hierarchy that does not, at least in peacetime, reward creativity. Troops with good technical skills can make more money, and get hassled less, in a similar civilian job. The military is aware of these problems, but it is slow going trying to fix them.